ClawHub
Back to skill

Security audit

Langsmith Fetch

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed LangSmith debugging helper, but it can access and locally save private trace data when the user asks it to debug agents.

Install only if you trust the langsmith-fetch CLI and are comfortable letting your agent read LangSmith traces for the selected project. Avoid printing API keys into shared terminals or logs, prefer scoped LangSmith credentials, and treat exported debug folders or JSON files as sensitive because they may contain prompts, tool outputs, memory data, and conversation traces.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.